PT-2015-1686 · Openssl+1 · Openssl+3
Daniel Danner
+1
·
Publicado
2015-03-19
·
Atualizado
2022-12-13
·
CVE-2015-0290
CVSS v2.0
5.0
Média
| Vetor | AV:N/AC:L/Au:N/C:N/I:N/A:P |
Name of the Vulnerable Software and Affected Versions
OpenSSL versions 1.0.2 through 1.0.2a
Description
The issue is related to the multi-block feature in the ssl3 write bytes function, which does not properly handle certain non-blocking I/O cases. This can allow remote attackers to cause a denial of service, resulting in pointer corruption and application crash. The vulnerability is associated with errors in the code and can be exploited by a remote attacker to cause a denial of service due to errors in handling certain input-output operations.
Recommendations
For OpenSSL versions 1.0.2 through 1.0.2a, update to version 1.0.2a or later to resolve the issue. As a temporary workaround, consider restricting the use of the ssl3 write bytes function until a patch is available. Avoid using non-blocking I/O cases with the multi-block feature in the ssl3 write bytes function until the issue is resolved.
Correção
DoS
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Cisco Asa
Cisco Ios Xe
Cisco Nexus
Openssl